What is the difference between search and hash?

search is the query string beginning with ? and is sent to the server. hash is the fragment beginning with # and is never transmitted — it exists only in the client.

Why does my URL's host look different after parsing?

The WHATWG algorithm lowercases the host, converts internationalised domains to Punycode (xn--), and drops a port that matches the scheme default. Browsers do exactly the same.

How do I safely check whether a URL belongs to my domain?

Parse it and compare the host component exactly, or check it ends with '.yourdomain.com'. Substring matching on the whole URL is bypassable and is the root of many open-redirect vulnerabilities.

Does the parser fetch the URL?

No. It decomposes the string only, so nothing is requested and no network side effect occurs.

URL & Links🌐 YAS server-sideAPI availablebeginner

URL Parser

Splits any URL into its parts: protocol, host, port, path, query, fragment and UTM parameters.

Processed by YAS · not stored

Ready to runInstant execution

All tools →

Result

—

What does this tool do?

Splits any URL into its parts: protocol, host, port, path, query, fragment and UTM parameters.

Why would I use it?

You want to understand what a long URL is actually pointing at.
You are building or debugging links with query parameters.
You are auditing UTM tagging on campaign links.

Real-life example

Input

https://example.com/products?id=42&utm_source=google

Output

protocol: https
host: example.com
path: /products
query: id=42&utm_source=google
utm_source: google

Every URL component is labeled.

Input → Process → Output → Next

Input: Paste a URL.
Process: YAS parses it into components and flags UTM parameters.
Output: A labeled breakdown of the URL.
Next action: Use the breakdown to debug links or normalize tracking.

Common mistakes

Pasting a bare domain without scheme (add https://).
Expecting punycode/hostname normalization.
Misreading the fragment (#) as part of the path.

What the result means

Each component is shown separately so you can see exactly what the URL does.

Privacy & security

Your input is sent to YAS infrastructure because the tool requires server-side processing or public network queries. Input is not stored.

API

Endpoint

POST https://yas.sh/api/v1/tools/url-parser

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/url-parser" \
  -H "Content-Type: application/json" \
  -d '{"input":"https://user:pass@example.com:8443/a/b?q=1#frag"}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/url-parser", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "input": "https://user:pass@example.com:8443/a/b?q=1#frag"
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/url-parser", json={"input":"https://user:pass@example.com:8443/a/b?q=1#frag"})
data = r.json()

Field	Type	Required	Description
input	string	Yes	Any URL

Success response

{ "result": { "protocol": "https:", "host": "example.com:8443", "hostname": "example.com", "port": "8443", "pathname": "/a/b", "query": { "q": "1" }, "hash": "#frag", "origin": "https://example.com:8443" } }

Split any URL into protocol, auth, host, port, path, query (parsed), hash + origin.

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

How URL Parser works

Parsing follows the WHATWG URL Standard, the same algorithm browsers use, which decomposes a URL into protocol, username, password, host, port, pathname, search and hash. It is deliberately more forgiving than RFC 3986: backslashes are normalised to forward slashes, tabs and newlines are stripped, the host is lowercased and IDNA-encoded to Punycode, and a default port matching the scheme is removed.

Those normalisation steps are where security bugs live. A URL that a naive parser reads as pointing to one host may be read by a browser as pointing to another — userinfo containing an @ symbol, unusual whitespace, or mixed encoding are all classic tricks for making a link look like it targets a trusted domain. Parsing with the same algorithm the client will use is the only reliable way to know the real destination.

When to use it: real-world scenarios

Validating a redirect target against an allowlist

Compare the parsed host, not a substring of the raw string. A check for 'example.com' matches evil-example.com.attacker.net; a host comparison does not.

Extracting parameters from a tracked link

Reading back the exact UTM values a partner used is faster than deciphering a long query string by eye, and it surfaces duplicated keys.

Debugging a routing mismatch

Trailing slashes, encoded characters and case in the pathname decide which route matches. Seeing the parsed pathname resolves the argument quickly.

Auditing links found in logs or emails

Normalisation reveals internationalised or Punycode hosts that visually impersonate a legitimate domain.

Pro tips

Always compare the parsed host for allowlists, and compare it for equality or as a suffix after a dot — never with a plain substring match.
The fragment never reaches the server. Anything after # is client-side only, which matters when debugging why a parameter appears missing in logs.
Watch for userinfo: https://trusted.com@evil.com resolves to evil.com. This is the most common visual spoofing pattern in phishing links.
A URL without a scheme is not a URL to the parser. Prefix https:// before parsing user input that omits it.

Limitations and edge cases

What this tool deliberately does not do, and where it will disagree with other implementations.

Parsing only — no network request is made, so the tool cannot say whether the URL resolves or what it returns.
Relative URLs need a base to resolve against; on their own they are not parseable.
Non-special schemes (mailto:, data:, custom app schemes) parse with different rules and expose fewer components.
The parser normalises input, so the output may differ from the original string in ways that matter for exact-match comparisons.

Frequently asked questions

What is the difference between search and hash?: search is the query string beginning with ? and is sent to the server. hash is the fragment beginning with # and is never transmitted — it exists only in the client.
Why does my URL's host look different after parsing?: The WHATWG algorithm lowercases the host, converts internationalised domains to Punycode (xn--), and drops a port that matches the scheme default. Browsers do exactly the same.
How do I safely check whether a URL belongs to my domain?: Parse it and compare the host component exactly, or check it ends with '.yourdomain.com'. Substring matching on the whole URL is bypassable and is the root of many open-redirect vulnerabilities.
Does the parser fetch the URL?: No. It decomposes the string only, so nothing is requested and no network side effect occurs.